Lucene search
+L

1282 matches found

RedhatCVE
RedhatCVE
added 2026/09/11 11:44 p.m.12 views

CVE-2026-89702

A flaw was found in the Linux kernel's Network File System Daemon nfsd. When processing NFSv2/v3-over-UDP requests, the nfsdfhverify and nfsdfhverifyerr tracepoints incorrectly size a memory buffer. This can lead to an out-of-bounds write, potentially allowing a remote attacker to cause a denial ...

9.8CVSS5.7AI score0.00463EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
added 2026/09/11 11:25 p.m.10 views

CVE-2026-89478

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. An authenticated attacker could exploit a timing window during the removal of an SCTP transport. This could lead to the system attempting to read from freed memory, potentially causing a denial of...

9.8CVSS5.6AI score0.00521EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
added 2026/09/11 11:00 p.m.9 views

CVE-2026-89674

A flaw was found in the nfsd component of the Linux kernel. Incorrect calculations in the XDR External Data Representation buffer size within the nfsd4ffencodelayoutget function can lead to two critical issues. An attacker could potentially exploit this to write data beyond the intended memory...

9.8CVSS5.8AI score0.00521EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
added 2026/09/11 10:37 p.m.11 views

CVE-2026-89614

A flaw was found in the Linux kernel's NTFS file system driver. This vulnerability occurs because the free-cluster bitmap scan is not properly bounded to the volume size. A specially crafted NTFS image, where the bitmap covers more clusters than the volume actually has, can lead to an out-of-boun...

9.8CVSS5.7AI score0.00407EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
added 2026/09/11 10:22 p.m.11 views

CVE-2026-80931

A flaw was found in the Linux kernel's w1: ds28e17 1-Wire to I2C bridge driver. A malicious I2C slave device can provide an oversized length during an I2C block read operation. This causes the driver to read beyond the allocated buffer, leading to an out-of-bounds read of up to 222 bytes. This...

7.8CVSS5.5AI score0.00129EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
added 2026/09/11 9:46 p.m.10 views

CVE-2026-89481

A flaw was found in the Linux kernel's NVMe Non-Volatile Memory Express over TCP nvme-tcp component. A malicious NVMe controller can exploit this vulnerability by sending a Ready to Transfer R2T command for a read request. The host system, failing to properly validate the request direction, will...

7.5CVSS5.8AI score0.00413EPSS
SaveExploits0References7
RedhatCVE
RedhatCVE
added 2026/09/11 8:53 p.m.9 views

CVE-2026-89515

A flaw was found in the Linux kernel's SCSI core component. When processing data transfers using scatter-gather lists, the system does not properly initialize padding bytes for unaligned data elements. This can result in the exposure of uninitialized memory, potentially allowing a local attacker ...

5.5CVSS5.6AI score0.00176EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
added 2026/09/11 8:28 p.m.11 views

CVE-2026-80961

A flaw was found in the dm-pcache component of the Linux kernel. A local attacker with CAPSYSADMIN capabilities could exploit unbounded fields decoded from the cache device. This could lead to an out-of-bounds read, potentially disclosing sensitive information from adjacent persistent memory to...

7.8CVSS5.6AI score0.00161EPSS
SaveExploits0References4
OSV
OSV
added 2026/09/11 8:20 p.m.5 views

UBUNTU-CVE-2026-89765

In the Linux kernel, the following vulnerability has been resolved: timers/itimer: Zero-init old itimerval before copy to userspace On native sparc64, struct kerneloldtimeval contains a four-byte hole after tvusec because tvsec is 64-bit while kernelsusecondst is 32-bit. putitimerval fills only t...

5.9AI score0.00196EPSS
SaveExploits0References7
NVD
NVD
added 2026/09/11 8:19 p.m.8 views

CVE-2026-89691

In the Linux kernel, the following vulnerability has been resolved: nfsd: clear opcnt on compound arg release to prevent OOB read nfsd4releasecompoundargs resets args-ops to the inline iops8 array when the dynamically-allocated ops buffer is freed, but leaves args-opcnt at its original value whic...

7.1CVSS0.00125EPSS
SaveExploits0References4
OSV
OSV
added 2026/09/11 8:19 p.m.7 views

AZL-100637 CVE-2026-89674 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix XDR length calculation in nfsd4ffencodelayoutget The XDR buffer size calculation in nfsd4ffencodelayoutget has multiple errors that can result in either an out-of-bounds write or leaking uninitialized kernel memory to t...

9.8CVSS6AI score0.00521EPSS
SaveExploits0References1
NVD
NVD
added 2026/09/11 8:19 p.m.7 views

CVE-2026-89649

In the Linux kernel, the following vulnerability has been resolved: ceph: bound xattr value length in buildxattrs buildxattrs decodes the MDS-supplied xattr blob one attribute at a time. For each attribute it reads a 32-bit name length, advances past the name bytes, reads a 32-bit value length,...

9.1CVSS0.00669EPSS
SaveExploits0References8
OSV
OSV
added 2026/09/11 8:19 p.m.8 views

DEBIAN-CVE-2026-89628

In the Linux kernel, the following vulnerability has been resolved: HID: picolcd: clamp eeprom debugfs read to bytes actually received picolcddebugeepromread trusts resp-rawdata2 -- a length byte supplied by the device in its REPORTEEDATA reply -- clamped only to the caller's read count: ret =...

6.1AI score0.0022EPSS
SaveExploits0References1
OSV
OSV
added 2026/09/11 8:19 p.m.8 views

AZL-100496 CVE-2026-89631 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject a tree connect response whose byte count is too small CIFSTCon bounds its strnlen over the byte area with the server's ByteCount minus two, which for ByteCount 0 or 1 goes negative as an int and converts to a...

9.1CVSS5.9AI score0.00448EPSS
SaveExploits0References1
OSV
OSV
added 2026/09/11 8:19 p.m.7 views

DEBIAN-CVE-2026-89631

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject a tree connect response whose byte count is too small CIFSTCon bounds its strnlen over the byte area with the server's ByteCount minus two, which for ByteCount 0 or 1 goes negative as an int and converts to a...

9.1CVSS6AI score0.00448EPSS
SaveExploits0References1
OSV
OSV
added 2026/09/11 8:19 p.m.8 views

DEBIAN-CVE-2026-89583

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: eir: Fix OOB read in eirgetservicedata eirgetservicedata walks the advertising data for a Service Data field with a matching UUID. On a mismatch it advances: eir += dlen; eirlen -= dlen; eirgetdata reports dlen as the...

8.1CVSS6.1AI score0.00271EPSS
SaveExploits0References1
OSV
OSV
added 2026/09/11 8:19 p.m.3 views

UBUNTU-CVE-2026-89698

In the Linux kernel, the following vulnerability has been resolved: nfsd: widen nfsdgenlrqstp address fields to sockaddrstorage struct nfsdgenlrqstp declares rqdaddr and rqsaddr as plain "struct sockaddr" 16 bytes. When an IPv6 NFS client is connected, nfsdgenlrpcstatuscomposemsg casts these fiel...

5.9AI score0.00198EPSS
SaveExploits0References6
UbuntuCve
UbuntuCve
added 2026/09/11 8:19 p.m.7 views

CVE-2026-80970

In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: do not copy out an uninitialised init response fcpioctlinit allocates its response buffer with kmalloc and copies the whole buffer back to userspace: bufsize = init.step0respsize + init.step2respsize; void resp freekfr...

6.1AI score0.00198EPSS
SaveExploits0References4
OSV
OSV
added 2026/09/11 7:47 p.m.8 views

CVE-2026-89768 fs: fix user path of nested backing files

In the Linux kernel, the following vulnerability has been resolved: fs: fix user path of nested backing files backingfileopen derives the path to be stored in the new backing file from userfile-fpath. This is incorrect when userfile itself is a backing file, which is the case for nested stacking...

6AI score
SaveExploits0References7
CVE
CVE
added 2026/09/11 7:46 p.m.10 views

CVE-2026-89698

CVE-2026-89698 is a Linux kernel vulnerability in the NFS daemon (nfsd) generic netlink interface. The rq_daddr and rq_saddr fields in struct nfsd_genl_rqstp are declared as struct sockaddr (16 bytes), but nfsd_genl_rpc_status_compose_msg() casts them to struct sockaddr_in6 * (28 bytes) when an I...

5.8AI score0.00198EPSS
SaveExploits0References3
Rows per page
Query Builder